CampTix Invoices: Don't record the invoice PDF when generation fails

[wputasic]

Fixes #1760.

Problem

create_invoice_document() records the invoice_document post meta unconditionally. WordCamp_Docs_PDF_Generator runs exec( 'wkhtmltopdf ...' ) with no error checking and returns the target path either way, and the rename() return value is ignored — so when PDF generation fails, the invoice still ends up pointing at a file that was never written. The "Download invoice" button then 404s, send_invoice() attaches a missing file, and nothing is logged anywhere organizers or support can see. This happened network-wide when wkhtmltopdf was temporarily unavailable on production in July 2026.

Fix

Only record the document once the PDF verifiably exists:

• bail and log via $camptix->log() if the generated file is missing or zero bytes;
• bail and log if the rename() into uploads/camptix-invoices/ fails;
• only then write the invoice_document meta.

Both callers ignore the function's return value, so the early return false requires no caller changes, and the shared WordCamp_Docs_PDF_Generator class is untouched. Invoices that hit the guard can be regenerated later simply by re-saving (the save_post handler already regenerates, reusing the stored filename when present).

Testing

Verified in the local Docker environment (multisite, camptix-invoices active):

• Failure path (wkhtmltopdf unavailable): create_invoice_document() returns false, no invoice_document meta is written, and the expected log entry (message + filename) appears in the CampTix network log via camptix-network-tools. On the unpatched code the same scenario writes meta pointing at a nonexistent PDF — reproducing the July incident.
• Happy path: PDF is generated, moved into uploads/camptix-invoices/, and the meta is written exactly as before.